相关文章

dissect.cobaltstrike

dissect.cobaltstrike是一个 Python 库，用于剖析和解析 Cobalt Strike 相关数据，例如信标有效负载和可扩展 C2 配置文件。

安装

该库在 PyPI 上可用。用于pip安装它：

  1. $ pip install dissect.cobaltstrike

dissect.cobaltstrike需要 Python 3.6 或更高版本。

文档

基本用法

加载信标并访问一些属性和设置：

  1. >>> from dissect.cobaltstrike.beacon import BeaconConfig
  2. >>> bconfig = BeaconConfig.from_path("beacon.bin")
  3. >>> bconfig.version
  4. <BeaconVersion 'Cobalt Strike 4.2 (Nov 06, 2020)', tuple=(4, 2), date=2020-11-06>
  5. >>> hex(bconfig.watermark)
  6. '0x5109bf6d'
  7. >>> bconfig.protocol
  8. 'https'
  9. >>> bconfig.settings
  10. mappingproxy({'SETTING_PROTOCOL': 8,
  11.               'SETTING_PORT': 443,
  12.               'SETTING_SLEEPTIME': 5000,
  13.               'SETTING_MAXGET': 1048576,
  14.               'SETTING_JITTER': 0, ...
  15. >>> bconfig.settings["SETTING_C2_REQUEST"]
  16. [('_HEADER', b'Connection: close'),
  17.  ('_HEADER', b'Accept-Language: en-US'),
  18.  ('BUILD', 'metadata'),
  19.  ('MASK', True),
  20.  ('BASE64', True),
  21.  ('PREPEND', b'wordpress_ed1f617bbd6c004cc09e046f3c1b7148='),
  22.  ('HEADER', b'Cookie')]

加载 Malleable C2 配置文件和访问设置：

  1. >>> from dissect.cobaltstrike.c2profile import C2Profile
  2. >>> profile = C2Profile.from_path("amazon.profile")
  3. >>> profile.as_dict()
  4. {'sleeptime': ['5000'],
  5.  'jitter': ['0'],
  6.  'maxdns': ['255'],
  7.  'useragent': ['Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'],
  8.  'http-get.uri': ['/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'],
  9.  'http-get.client.header': [('Accept', '*/*'), ('Host', 'www.amazon.com')],
  10.  ...
  11. }
  12. >>> profile.properties["useragent"]
  13. ['Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko']
  14. >>> profile.properties["http-get.uri"]
  15. ['/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books']

执照

dissect.cobaltstrike是在 MIT 许可下开发和分发的。